Zod vs Joi vs Yup: Performance Benchmarks

Choosing a validation library on the basis of DX alone is reasonable until validation lands on a hot path — a high-frequency API route, an edge Worker executing on every request, or a parser running inside a tight transformation loop. This guide extends Runtime Validation with Zod with a structured look at how Zod 3.23, Joi 17, and Yup 1.4 compare on throughput, latency, and bundle footprint, and explains how to benchmark them fairly using tinybench.

The numbers below are illustrative and representative — produced on a reference machine to demonstrate methodology and relative ordering. Run the benchmark suite in your own environment before making architectural decisions. Results vary significantly with Node.js version, hardware, JIT warmup, and schema shape.

Why Library Choice Affects Performance

All three libraries parse and coerce JavaScript values against a schema at runtime, but their internal architectures differ in ways that compound under load.

Zod 3.23 builds schemas as a tree of ZodType objects. Parsing is a single synchronous recursive descent. There are no Promises on the happy path, which keeps the V8 JIT warm and avoids microtask queue pressure.

Joi 17 represents schemas as compiled rule chains. It performs eager compilation during Joi.object() construction and uses an internal caching layer for repeated validations of the same schema instance. This is a win for long-lived server processes that construct schemas once at startup.

Yup 1.4 introduced a synchronous path (validateSync) in earlier versions, but its architecture is deeply promise-oriented. Even validateSync builds and immediately resolves a Promise internally on many code paths, which adds allocation overhead that accumulates at high throughput.

Benchmark Methodology

Fair microbenchmarks require four controls:

1. Schema-instance parity — all three libraries validate structurally identical schemas (same fields, same constraints). Benchmarking a five-field Zod schema against a twenty-field Joi schema tells you nothing useful.
2. Synchronous path isolation — use schema.parse() / Joi.attempt() / schema.validateSync() to eliminate Promise scheduling noise.
3. Warmup iterations — tinybench runs warmupIterations before recording to allow JIT compilation of hot code paths.
4. Multiple payload sizes — a flat five-field object, a nested ten-field object, and a twelve-item array of nested objects expose different algorithmic behaviours.

Installing tinybench

npm install --save-dev tinybench
# or
pnpm add -D tinybench

Annotated Benchmark TypeScript Code

// bench/validation.bench.ts
// Node.js 22, Zod 3.23, Joi 17.13, Yup 1.4.0
import { Bench } from 'tinybench';
import { z } from 'zod';
import Joi from 'joi';
import * as yup from 'yup';

// ── Payload definitions ────────────────────────────────────────────────────

/** Flat payload: five primitive fields */
const flatPayload = {
  id: 'usr_a1b2c3',
  email: 'user@example.com',
  age: 28,
  role: 'admin',
  active: true,
};

/** Nested payload: address sub-object + tags array */
const nestedPayload = {
  id: 'usr_a1b2c3',
  email: 'user@example.com',
  age: 28,
  role: 'admin',
  active: true,
  address: {
    street: '42 Contract Lane',
    city: 'Schematon',
    country: 'US',
    postalCode: '10001',
  },
  tags: ['api', 'governance', 'zod'],
};

// ── Schema definitions (constructed ONCE — not inside the bench loop) ──────

// Zod 3.23
const zodFlatSchema = z.object({
  id: z.string(),
  email: z.string().email(),
  age: z.number().int().min(0).max(120),
  role: z.enum(['admin', 'user', 'readonly']),
  active: z.boolean(),
}).strict();

const zodNestedSchema = zodFlatSchema.extend({
  address: z.object({
    street: z.string(),
    city: z.string(),
    country: z.string().length(2),
    postalCode: z.string().regex(/^\d{5}$/),
  }),
  tags: z.array(z.string()).max(20),
}).strict();

// Joi 17.13
const joiFlatSchema = Joi.object({
  id: Joi.string().required(),
  email: Joi.string().email().required(),
  age: Joi.number().integer().min(0).max(120).required(),
  role: Joi.string().valid('admin', 'user', 'readonly').required(),
  active: Joi.boolean().required(),
}).options({ allowUnknown: false });

const joiNestedSchema = joiFlatSchema.append({
  address: Joi.object({
    street: Joi.string().required(),
    city: Joi.string().required(),
    country: Joi.string().length(2).required(),
    postalCode: Joi.string().pattern(/^\d{5}$/).required(),
  }).required(),
  tags: Joi.array().items(Joi.string()).max(20).required(),
});

// Yup 1.4.0
const yupFlatSchema = yup.object({
  id: yup.string().required(),
  email: yup.string().email().required(),
  age: yup.number().integer().min(0).max(120).required(),
  role: yup.mixed<'admin' | 'user' | 'readonly'>()
    .oneOf(['admin', 'user', 'readonly']).required(),
  active: yup.boolean().required(),
}).noUnknown(true);

const yupNestedSchema = yup.object({
  ...yupFlatSchema.fields,
  address: yup.object({
    street: yup.string().required(),
    city: yup.string().required(),
    country: yup.string().length(2).required(),
    postalCode: yup.string().matches(/^\d{5}$/).required(),
  }).required(),
  tags: yup.array().of(yup.string().required()).max(20).required(),
}).noUnknown(true);

// ── Benchmark suites ───────────────────────────────────────────────────────

const flatBench = new Bench({
  name: 'Flat object validation (5 fields)',
  warmupIterations: 1_000,
  iterations: 50_000,
});

flatBench
  .add('Zod 3.23 — flat', () => {
    zodFlatSchema.parse(flatPayload);
  })
  .add('Joi 17  — flat', () => {
    joiFlatSchema.validate(flatPayload, { abortEarly: true });
  })
  .add('Yup 1.4 — flat', () => {
    // validateSync avoids async overhead; still allocates Promises internally
    yupFlatSchema.validateSync(flatPayload);
  });

const nestedBench = new Bench({
  name: 'Nested object validation (10 fields)',
  warmupIterations: 1_000,
  iterations: 50_000,
});

nestedBench
  .add('Zod 3.23 — nested', () => {
    zodNestedSchema.parse(nestedPayload);
  })
  .add('Joi 17  — nested', () => {
    joiNestedSchema.validate(nestedPayload, { abortEarly: true });
  })
  .add('Yup 1.4 — nested', () => {
    yupNestedSchema.validateSync(nestedPayload);
  });

// ── Run ────────────────────────────────────────────────────────────────────

async function run() {
  await flatBench.run();
  await nestedBench.run();

  for (const bench of [flatBench, nestedBench]) {
    console.log(`\n${bench.name}`);
    console.table(
      bench.tasks.map((t) => ({
        name: t.name,
        'ops/sec': Math.round(1e9 / (t.result!.mean)),
        'mean (µs)': (t.result!.mean / 1e3).toFixed(2),
        'p99 (µs)': (t.result!.p99 / 1e3).toFixed(2),
      }))
    );
  }
}

run();

Why schema construction is outside the loop: Schema objects in all three libraries are expensive to build (Joi compiles rules; Zod allocates a type graph). In production you construct once at module load and reuse. Benchmarking construction inside the loop conflates startup cost with per-request cost and produces misleading results.

abortEarly: true for Joi: This matches the Joi default. Using abortEarly: false (collect all errors) adds roughly 15–25% overhead on invalid payloads because Joi walks the full schema even after the first failure.

Results Comparison Table

Results below are illustrative — representative of the relative ordering observed on Node.js 22.x running on an AMD Ryzen 9 7950X (Linux, single-threaded). Your numbers will differ. Use them to understand the shape of the performance landscape, not as production baselines.

Bundle size note: Figures are minified + gzipped, measured with bundlephobia methodology. Zod 3.23 ships with zero runtime dependencies. Joi 17 bundles its own @hapi/hoek, @hapi/topo, and @sideway/* packages. Yup 1.4 pulls in property-expr and tiny-case.

Illustrative Validation Throughput (ops/sec) — Flat vs Nested Payloads

Ops / sec (×1000)

# Install dependencies (tinybench, zod, joi, yup)
npm install --save-dev tinybench
npm install zod joi yup

# Execute with ts-node or tsx
npx tsx bench/validation.bench.ts

Flat object validation (5 fields)
┌─────────────────────┬───────────┬────────────────┬─────────────────┐
│ name                │ ops/sec   │ mean (µs)      │ p99 (µs)        │
├─────────────────────┼───────────┼────────────────┼─────────────────┤
│ Zod 3.23 — flat     │ 1 047 382 │ 0.95           │ 1.73            │
│ Joi 17  — flat      │   718 955 │ 1.39           │ 2.61            │
│ Yup 1.4 — flat      │   308 241 │ 3.24           │ 5.92            │
└─────────────────────┴───────────┴────────────────┴─────────────────┘

npx bundlephobia zod@3.23.0 joi@17.13.0 yup@1.4.0